genesis-compiler 1.3.2 → 1.3.3

package/README.md

@@ -866,6 +866,7 @@ import {
   setCollaboration,
   setEngineeringProfile,
   verify,
+  withTrustedGitRepository,
 } from 'genesis-compiler';
 ```
 
@@ -894,6 +895,15 @@ projection paths without returning any supplied environment value.
 `inspectStackSection()` returns one exact consumer-owned section without
 interpreting or executing its contents.
 
+Hosts that already validate access to a shared worktree may wrap an operation
+in `withTrustedGitRepository(absoluteWorktreeRoot, () => inspectEnvironment({
+projectRoot: absoluteWorktreeRoot }))`. This explicitly trusts that one
+canonical worktree for Genesis's Git subprocesses in the callback's async
+context. Concurrent and nested operations remain isolated; it does not change
+global Git configuration, repository ownership, or filesystem permissions.
+Without this explicit host grant, Git's ownership check remains in force and
+an ownership rejection reports `GIT_REPOSITORY_UNTRUSTED`.
+
 Normalized results identify their stable public contract in the `contract`
 field: `genesis.collaboration.v1`, `genesis.engineering.v1`,
 `genesis.environment.v2`, `genesis.session-context.v1`,

package/docs/assurance-model.md

@@ -40,3 +40,12 @@ This keeps ordinary single-user projects conventional while allowing a managed
 host to require shared-group writes and no access for other users. The host is
 responsible for establishing and verifying that umask, setgid directory, ACL,
 and cross-identity contract before Genesis or an agent starts.
+
+A host may explicitly grant `withTrustedGitRepository()` one canonical,
+absolute worktree root it has already authorized. Genesis carries that exact
+`safe.directory` only in its Git subprocess arguments within the operation's
+async context. It does not trust all repositories, inherit another concurrent
+operation's grant, or modify Git configuration or ownership. Ordinary calls
+retain Git's ownership protection. Trust is not a filesystem sandbox and does
+not authorize the callback itself; selecting and authorizing the root remains
+the host's responsibility.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-compiler",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "type": "module",
   "description": "An agent-independent prompt, multi-language code-index, cleanup, and verification companion with project agent guidance.",
   "repository": {

package/src/index/git.js

@@ -15,7 +15,12 @@ export async function gitContext(projectRoot = process.cwd()) {
   let repositoryRoot;
   try {
     repositoryRoot = await realpath(path.resolve(await runGitText(root, ['rev-parse', '--show-toplevel'])));
-  } catch {
+  } catch (error) {
+    if (/detected dubious ownership/iu.test(error?.details?.stderr || '')) {
+      fail('GIT_REPOSITORY_UNTRUSTED', `Git rejected ownership of the project worktree: ${projectRoot}. The caller must explicitly trust this shared repository.`, {
+        cause: error.code,
+      });
+    }
     fail('GIT_REPOSITORY_REQUIRED', `Project root is not inside a Git worktree: ${projectRoot}.`);
   }
   const relative = path.relative(repositoryRoot, root);

package/src/index/process.js

@@ -1,9 +1,24 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { spawn } from 'node:child_process';
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
 
 import { GenesisError } from './errors.js';
 
 const MAX_DIAGNOSTIC_OUTPUT = 16_384;
 const DEFAULT_TERMINATION_GRACE_MS = 1_000;
+const trustedGitRepository = new AsyncLocalStorage();
+
+/** A host may explicitly trust one validated worktree for this async operation. */
+export async function withTrustedGitRepository(repositoryRoot, operation) {
+  if (typeof repositoryRoot !== 'string' || !path.isAbsolute(repositoryRoot) || repositoryRoot.includes('*')) {
+    throw new TypeError('Git repository trust requires an explicit absolute worktree path without wildcards.');
+  }
+  if (typeof operation !== 'function') throw new TypeError('Git repository trust requires an operation.');
+  const root = await realpath(repositoryRoot);
+  if (root.includes('*')) throw new TypeError('Git repository trust does not accept wildcard paths.');
+  return trustedGitRepository.run(root, operation);
+}
 
 function processTerminationError(code, message) {
   const error = new Error(message);
@@ -180,10 +195,12 @@ export async function runProcess(command, args, {
 }
 
 export async function runGit(cwd, args, options = {}) {
+  const trustedRoot = trustedGitRepository.getStore();
   return runProcess('git', [
     '-c', 'core.hooksPath=/dev/null',
     '-c', 'commit.gpgSign=false',
     '-c', 'core.fsmonitor=false',
+    ...(trustedRoot ? ['-c', `safe.directory=${trustedRoot}`] : []),
     ...args,
   ], {
     cwd,

package/src/index.js

@@ -24,6 +24,7 @@ import { addStackPieces, readStack } from './index/stack.js';
 import { uniqueSorted } from './index/utils.js';
 import { verifyProject } from './index/verification.js';
 import { projectSessionContext, projectTurnContext } from './index/session-context.js';
+import { withTrustedGitRepository } from './index/process.js';
 import {
   HOST_CONTEXT_RESOLVER_DATA_ENV,
   HOST_CONTEXT_RESOLVER_ENV,
@@ -37,6 +38,7 @@ export {
   SESSION_CONTEXT_INSTALLED_ENV,
   projectSessionContext,
   projectTurnContext,
+  withTrustedGitRepository,
 };
 
 function withIndexResult(result, index) {